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FIG. 1 

The stack at the beginning of the call to dangerous function. 
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FIG. 2 

The stack at the point of the unbounded function call. 
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FIG. 1 



The stack after the unbounded function call. 
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FIG. 4 

Revised diagram of the stack after the unbounded function call, 
incorporating idle sequence and multiple return addresses. 
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% idle/3 - Predicate representing an idle instructions, consisting of 

% opcode of instruction in hexadecimal, assembler mnemonic for 

% instruction, unique ID of instruction 

idle (Ox90, , nop , ,0). 

idleCOxfc/cld',!). 

idleCOxfiVstc'^). 

i<Ue(Oxfi,'cmcV3). 

idle(Oxf8, f clc',4). 

idle(Qx99, , cltd , ,5). 

idle(Qx9b, , fwait , ,6), 

% idlesequcnce/2 - Find the maximum number of consecutive idles 
% in the list of bytes 

idle^sequence (Bytes, MaxSequence) > sequence (Bytes, MaxSequence, 0,0). 
sequence Max, _^Max). 

sequence ([Byte/Rest], Fina^CurrenUVtax) :- idle (Byte,_,_ ), 

plus (1, Current, NewCurrent), 
greater (NewCurrent, Max, NewMax), 
sequence (Rest, Final^fewCurrent^NewMax). 

sequence ([Byte/Rest], Final,Currcnt^lax) :- not (idle (Byte,__,_ ) ), 

sequence (Rest, Final, 0, Max). 

% command/2 - Predicate representing a command, consisting of 

% name of command and unique ID of command 

command (£f, V, T, V, 7, V, V], 0). 

command ([V, V, 'i', V, 7, V, V, V, V], 1). 

command ([7, V, T, V, V, V, V, V], 2). 

command ([V, V, T, W, V.f , V, V, V], 3). 

command flY, V, 'i\ V, V, V, V, W], 4). 

command ([V, V, T, W. V, V, V, Til, 5). 

%command_command/1 - Is it true if the list of bytes contains a command 
containscommand (Bytes) :- command (Command, _), 

concat (_, B2, Bytes), 



concat (Command, _, B2,). 



% utility predicates 
greater (A, B, A) :-A>B. 
greater (A, B, B) :- B =< B. 
phis (A B, C) C is A + B. 
concat (0,L,L). 

concat ([X/Ll], L2, [X/L3]) :- concat (LI, L2, L3). 

FIG. 6 



Predicates from the Knowledge Base. 
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FIG. 9 



Experimental results for each sequence. 
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